IN THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1. (Currently amended) A network security apparatus system comprising: 

a billing server processor configured to ; and 

a memory, coupled to the processor, wherein the memory is configured to provide the 
processor with instructions which when executed cause the processor to: 

calculate security protection consumption during a period of time by 
quantifying]] damages avoided by one or more blocked attacks ; and 

calculate security consumption during a period of time . 

2. (Currently amended) The apparatus system of claim 1 , wherein calculating security 
protection consumption further quantifying damages includes determining whether a blocked 
attack would have exploited a network vulnerability. 

3. (Currently amended) The apparatus system of claim 2, wherein determining whether a 
blocked attack would have exploited network vulnerability includes replaying the attack on an 
internal network. 

4. (Currently amended) The apparatus system of claim 1 , further comprising a scanner 
configured to scan one or more devices for vulnerabilities. 

5. (Currently amended) The apparatus system of claim 4, wherein the scanner is configured 
to quantify the risk of one or more devices. 

6. (Currently amended) The apparatus system of claim 4, wherein the scanner is located 
within a customer network. 
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7. (Currently amended) The apparatus system of clam 1 , further comprising an intrusion 
suppression module configured to block attacks. 

8. (Currently amended) The apparatus system of claim 7, wherein the intrusion suppression 
module is configured to maintain a list of attacks sustained and blocked during a period of time. 

9. (Currently amended) The apparatus system of claim 7, wherein the intrusion suppression 
module is located outside a customer network. 

10. (Previously presented) A network security method comprising: 

quantifying damages avoided by one or more blocked attacks; and 
calculating security protection consumption during a period of time. 

1 1 . (Previously presented) The method of claim 1 0, further comprising determining whether a 
blocked attack would have exploited network vulnerability. 

12. (Previously presented) The method of claim 10, further comprising scanning one or more 
devices for vulnerabilities. 

13. (Previously presented) The method of claim 12, further comprising quantifying the risk of 
one or more devices. 

14. (Previously presented) The method claim 1, further comprising blocking one or more 
attacks. 

15. (Previously presented) The method of claim 14, further comprising maintaining a list of 
attacks sustained and blocked during a period of time. 

16. (Original) A network security apparatus comprised of: 

means for quantifying damages avoided by one or more blocked attacks; and 
means for calculating security protection consumption during a period of time. 
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17. (Original) The apparatus of claim 16, further comprised of the means for determining 
whether a blocked attack would have exploited network vulnerability. 

18. (Original) The apparatus of claim 16, further comprised of the means for scanning one or 
more devices for vulnerabilities. 

19. (Original) The apparatus of claim 18, further comprised of the means for quantifying the risk 
of one or more devices. 

20. (Original) The apparatus claim 16, further comprised of the means for blocking one or more 
attacks. 

21. (Original) The apparatus of claim 20, further comprised of the means for maintaining a list 
of attacks sustained and blocked during a period of time. 

22. (Currently amended) A computer program product embodied in a tangible computer- 
readable storage medium, and comprising computer instructions for: 

quantifying damages avoided by one or more blocked attacks; and 
calculating security protection consumption during a period of time. 

23 . (Previously presented) The computer program product of claim 2 1 , further comprising 
computer instructions for determining whether a blocked attack would have exploited network 
vulnerability. 

24. (Previously presented) The computer program product of claim 21, further comprising 
computer instructions for scanning one or more devices for vulnerabilities. 

25 . (Previously presented) The computer program product of claim 2 1 , further comprising 
computer instructions for quantifying risk of one or more devices. 

26. (Previously presented) The computer program product of claim 2 1 , further comprising 
computer instructions blocking one or more attacks. 
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27. (Previously presented) The computer program product of claim 26, further comprising 
computer instructions for maintaining a list of attacks sustained and blocked during a period of 
time. 

28. (Cancelled) 
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